Module http_server 

The Streamable HTTP MCP server: HTTP/1.1 + SSE over TCP (plain, or TLS via the [net::tls] acceptor), reusing the same Handler / [lifecycle_response] / SubRegistry as the socket servers. This is the serving mirror of the crate’s HTTP client (crate::http) and the transport the HTTPS control plane rides.

Model (Streamable HTTP, both eras):

• Unary — one POST carrying a JSON-RPC request; the reply is application/json. initialize is stamped with an Mcp-Session-Id (legacy). One request per connection (Connection: close), matching the client’s dialer.
• Reactive — a POST subscriptions/listen (modern, stateless): the connection becomes a long-lived text/event-stream. Each requested uri is run through the handler’s normal resources/subscribe gate (so the embedder’s per-origin subscribability rules apply unchanged) and, if accepted, this connection’s SSE write half is registered in the shared registry — so the embedder’s existing notify_* pushes reach it as SSE data: events. The stream is held open with periodic keep-alive comments; a failed write prunes the subscriptions and ends the connection.

Trust is never transport-derived. Every request is classified by an HttpAuth the embedder supplies (mutual-TLS client identity primary, bearer token alternative); an unauthenticated peer gets 401 and never reaches the handler.

Structs

AllowAll

Allow every request as PeerOrigin::Management — for loopback dev / tests only. NOT for a real listener (it makes the transport the trust boundary, exactly the posture the pivot removes).

PeerId

A verified mTLS peer’s identity, surfaced so an embedder can match a caller to a named principal rather than merely observing “a cert was presented”. All-empty for a plain / no-client-cert connection. rustls has already verified the chain; these fields are only read from the leaf certificate, so they are safe to compare against — but only because verification already happened.

RawRequest

A raw inbound HTTP request handed straight to a RawHandler: method, target (path + optional query), lowercased headers, and the raw body. Unlike the Handler path this does no JSON-RPC parsing and no transport-level auth — the embedder routes by RawRequest::path and authenticates itself (e.g. a per-webhook HMAC over the raw body). The DNS-rebind Origin guard and TLS termination still apply.

RawResponse

A raw HTTP response a RawHandler returns.

RequestParts

The parts of an inbound request an HttpAuth classifies trust from.

ServeOptions

Per-listener serving options beyond the handler/auth pair.

Enums

HttpAcceptor

How accepted TCP connections are wrapped: plaintext (loopback dev) or TLS (the production control plane). The TLS variant carries the [net::tls] acceptor, which drives the handshake (and, under mTLS, verifies the client certificate) at accept time.

Traits

HttpAuth

The embedder’s auth policy: classify an inbound request’s trust origin, or reject it. Called once per connection before the handler sees anything. The framework NEVER trusts by transport alone — return None to answer 401.

RawHandler

A raw-HTTP embedder surface (the agentd webhook listener). One call per request; the embedder routes and authenticates itself.

Functions

bind_tcp

Bind a TCP listener for HTTP serving. Kept separate from the accept loop so the caller can log/act on a successful bind (or propagate the error) before the accept thread starts.

spawn_accept_http

Spawn the background accept thread: one blocking thread per connection, each serving HTTP/1.1 (+ SSE) against handler, with trust classified by auth. Peers that authenticate arrive in whatever PeerOrigin auth mints.

spawn_accept_http_opts

spawn_accept_http with explicit ServeOptions (extra browser origins).

spawn_accept_raw

Spawn a raw-HTTP accept loop — TLS-terminated like spawn_accept_http, with the same DNS-rebind Origin guard — dispatching each request to handler.